Malicious PDF — malware analysis report

Static analysis result for SHA-256 5510e270fc2190f3…

MALICIOUS

PDF

130.3 KB Authoring application: Nitro PDF
MD5: a163ddbcac305bbaa4eefe5bdaa6f8a0 SHA-1: cd02cf0b945cb4ca391a68c176a70a254910ec71 SHA-256: 5510e270fc2190f3ef19f3efbd2f56c78adc07b2c46674ff1ce75b3d0a3af927
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO poisoning or phishing campaigns. The heuristic 'PDF_SEO_LINK_FARM' directly indicates this behavior, pointing to multiple suspicious URLs. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic suggests that the document may be part of a multi-stage attack where a password is provided to decrypt a subsequent payload, further increasing the malicious intent. ClamAV detection confirms the malicious nature of the file.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://angelicharpacademy.com/uploads/1/3/0/7/130739069/najabad_nipafuwazijakaf_raner.pdf
    • http://ageinmyplace.org/uploads/1/3/0/3/130379205/8bf4b313a.pdf
    • http://bewellca.com/uploads/1/3/0/6/130605516/pukasivoro-zijifaki-beloti-panuxug.pdf
    • http://garryandjen.com/uploads/1/3/0/5/130544043/216001.pdf
    • http://comtec.ch/uploads/1/3/0/5/130551202/6475387.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/7/130738914/130738914.html#anthem+anywhere+app

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011df.bin
1a763058647cc2962d7a2269e2d5ab380a443446c18879497d75c56002ef1846		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11DF 9304 bytes
font_01_sfnt_off00007ace.bin
5e566fc91a4ecdcd6d008a21548204138138b12c5fdfe548f8f6783c1ae7e0c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7ACE 17296 bytes
font_02_sfnt_off0001af89.bin
6f13902c56231375baabd7d7a9d552d75f195749e16f985683da6610eceab72e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF89 2856 bytes
font_03_sfnt_off0001b8c0.bin
37d45bb767782914137753a6fc95f91e622e7a806039e893722ffdd697646e18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B8C0 4164 bytes
font_04_sfnt_off0001c52f.bin
78178c25d330cbdf5bf1a96f1d081fe5998730bee79ff4054b9b99ca40e1f0d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C52F 4616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.